subchapter 23H – Confidentiality and access to client records
SECTION .0100 ‑ General
10A NCAC 23H .0101 SCOPE
The rules of this Subchapter protect the client's right to confidentiality. Non-identifying statistical information, general information about the scope of any programs administered by the agency, and any written policy relevant to the administration of the Medicaid program, are not confidential information.
History Note: Authority G.S. 108A-54; 108A-80;
Eff. September 1, 1984;
Amended Eff. August 1, 1990;
Transferred from 10A NCAC 21A .0401 Eff. May 1, 2012;
Pursuant to G.S. 150B-21.3A, rule is necessary without substantive public interest Eff. July 23, 2016.
10A NCAC 23H .0102 INFORMATION FROM OTHER AGENCIES
If the agency receives information from another agency or individual, that information shall be treated as any other information generated by the Division of Health Benefits or the county department of social services, and disclosure thereof will be governed by any condition imposed by the furnishing agency or individual.
History Note: Authority G.S. 108A-54; 108A-80;
Eff. September 1, 1984;
Transferred from 10A NCAC 21A .0402 Eff. May 1, 2012;
Pursuant to G.S. 150B-21.3A, rule is necessary without substantive public interest Eff. July 23, 2016;
Amended Eff. March 1, 2020.
10A NCAC 23H .0103 CONFIDENTIALITY
(a) Except as otherwise provided in these Rules it shall be unlawful for any person to obtain, disclose or use, or to authorize, permit or acquiesce to the use of any list of names or other information concerning any client applying for or receiving Medicaid that may be directly or indirectly derived from the records, files, or communications of the agency, or acquired in the course of performing official duties except for purposes directly connected with the administration of the Medicaid program.
(b) Whenever federal or state statutes or regulations specifically address confidentiality issues, the agency shall disclose or keep confidential client information in accordance with those federal or state statutes or regulations.
(c) Whenever there is inconsistency between federal or state statutes or regulations specifically addressing confidentiality issues, the agency shall abide by the statute or regulation which provides more protection for the client.
History Note: Authority G.S. 108A-54; 108A-80; 42 C.F.R. 431.302;
Eff. September 1, 1984;
Amended Eff. August 1, 1990;
Transferred from 10A NCAC 21A .0403 Eff. May 1, 2012;
Pursuant to G.S. 150B-21.3A, rule is necessary without substantive public interest Eff. July 23, 2016.
10A NCAC 23H .0104 OWNERSHIP OF RECORDS
(a) All client information contained in any records of the agency is the property of the agency, and employees of the agency shall protect and preserve such information from dissemination except as provided by the rules of this Subchapter.
(b) Original client records may not be removed from the premises by individuals other than authorized staff of the agency, except by a court order.
(c) The agency shall be allowed to destroy records in accordance with record retention schedules promulgated by the Division of Archives and History, rules of the Division of Medical Assistance, and state and federal statutes and regulations.
History Note: Authority G.S. 108A-54; 108A-80; 42 C.F.R. 431.306;
Eff. September 1, 1984;
Transferred from 10A NCAC 21A .0404 Eff. May 1, 2012;
Pursuant to G.S. 150B-21.3A, rule is necessary without substantive public interest Eff. July 23, 2016.
10A NCAC 23H .0105 SECURITY OF RECORDS
(a) The agency shall provide a secure place or places with controlled access for the storage of records. Only individuals who must access client information in order to carry out duties assigned or approved by the agency shall be authorized access to the storage area or areas.
(b) Only authorized individuals may remove a record from the storage area or areas and the authorizing individual shall be responsible for the security of the record until it is returned to the storage area or areas.
(c) The agency shall establish procedures to prevent accidental disclosure of client information from automated data processing systems.
(d) The director shall assure that all authorized individuals are informed of the confidential nature of client information and shall disseminate written policy to and provide training for all persons with access to client information.
History Note: Authority G.S. 108A-54; 108A-80; 42 C.F.R. 431.306;
Eff. September 1, 1984;
Amended Eff. August 1, 1990;
Transferred from 10A NCAC 21A .0405 Eff. May 1, 2012;
Pursuant to G.S. 150B-21.3A, rule is necessary without substantive public interest Eff. July 23, 2016.
10a NCAC 23H .0106 LIABILITY OF PERSONS WITH ACCESS
(a) Failure to comply with the rules in this Subchapter is unlawful pursuant to G.S. 108A-80.
(b) Individuals employed by the Division and county departments of social services and governed by the State Personnel Act are subject to suspension, dismissal, or disciplinary action for failure to comply with these Rules.
(c) Individuals other than employees, including volunteers and students who are agents of the Department of Health and Human Services and who have access to client information, shall be liable in the same manner as employees.
History Note: Authority G.S. 108A-54; 108A-54.1B; 108A-80; 42 C.F.R. 431, Subpart F;
Eff. September 1, 1984;
Amended Eff. August 1, 1990;
Transferred from 10A NCAC 21A .0406 Eff. May 1, 2012;
Readopted Eff. June 1, 2019.
10A NCAC 23H .0107 RIGHT OF ACCESS
(a) An individual has the right to obtain information about his or her own case. Upon written or verbal request, the client shall be able to review or obtain without charge a copy of the information in his or her records with the following exceptions:
(1) Information that the agency is required to keep confidential by State or federal statutes, rules, or regulations;
(2) Confidential information originating from another agency as set forth in Rule .0104 of this Section; and
(3) Information that would breach another individual's right to confidentiality under State or federal statutes, rules, or regulations as determined by the Division or the county department of social services.
(b) The agency shall provide access within five business days.
History Note: Authority G.S. 108A-54; 108A-54.1B; 108A-80; 42 C.F.R. 431.306;
Eff. September 1, 1984;
Transferred from 10A NCAC 21A .0407 Eff. May 1, 2012;
Readopted Eff. June 1, 2019.
10A NCAC 23H .0108 WITHHOLDING INFORMATION FROM THE CLIENT
(a) When the director or a delegated representative determines on the basis of the exceptions in Rule .0107 of this Section to withhold information from the client, this reason shall be documented in the client record.
(b) The director or delegated representative shall inform the client that information is being withheld, and upon which of the exceptions specified in Rule .0107 of this Section the decision to withhold the information is based. If confidential information originating from another agency is being withheld, the client shall be referred to that agency for access to the information.
(c) When a delegated representative determines to withhold client information, the decision to withhold shall be reviewed by the supervisor of the person making the initial determination.
History Note: Authority G.S. 108A-54; 108A-54.1B; 108A-80;
Eff. September 1, 1984;
Amended Eff. August 1, 1990;
Transferred from 10A NCAC 21A .0408 Eff. May 1, 2012;
Readopted Eff. June 1, 2019.
10A NCAC 23H .0109 PROCEDURE FOR REVIEW OF RECORDS
(a) The director or his or her delegated representative shall be present when the client reviews the record. The director or his or her delegated representative shall document in the client record the review of the record by the client.
(b) A client may contest the accuracy, completeness, or relevancy of the information in his or her record. If the Division or county department of social services determines correction is required by federal statute or regulation to support receipt of State or federal participation, the correction of the contested information shall be accomplished by inserting it in the record when the director or his or her delegated representative concurs that such correction is justified. When the director or his or her delegated representative does not concur, the client shall be allowed to enter a statement in the record. Deletion of the contested information is not permitted. If a delegated representative decides not to correct contested information, the decision not to correct shall be reviewed by the supervisor of the person making the initial decision. All corrections and statements shall be made a permanent part of the record and shall be disclosed to any recipient of the disputed information.
(c) Upon written request from the client, his or her personal representative, including an attorney, may have access to review or obtain without charge, a copy of the information in his or her record. The client may permit the personal representative to have access to his or her entire record or may restrict access to certain portions of the record. Rules .0107 and .0108 of this Section shall apply.
History Note: Authority G.S. 108A-54; 108A-54.1B; 108A-80;
Eff. September 1, 1984;
Transferred from 10A NCAC 21A .0409 Eff. May 1, 2012;
Readopted Eff. August 1, 2019.
10A NCAC 23H .0110 CONSENT FOR RELEASE
(a) As a part of the application process for Medicaid, the client shall be informed of the need for and give consent to release of information for verification of statements to establish eligibility.
(b) No individual shall release any client information that is owned by the Division of Health Benefits or the county departments of social services, or request the release of information regarding the client from other agencies or individuals, without obtaining a signed consent for release of information. The procedure for disclosure without obtaining consent shall be in accordance with Rule .0111 of this Section.
(c) The consent for release of information shall contain the following:
(1) The name of the provider and the recipient of the information;
(2) The extent of information to be released;
(3) The name and dated signature of the client;
(4) A statement that the consent is subject to revocation at any time except to the extent that action has been taken in reliance on the consent; and
(5) The length of time the consent is valid.
(d) The client may alter the form to contain other information, including:
(1) A statement specifying the date, event, or condition upon which the consent may expire even if the client does not expressly revoke the consent; or
(2) A specific purpose for the release.
(e) The following persons may consent to the release of information:
(1) The client;
(2) The legal guardian if the client has been judged incompetent; or
(3) The county department of social services if the client is a minor and in the custody of the county department of social services.
(f) Prior to obtaining a consent for release of information, the director or delegated representative shall explain the meaning of informed consent. The client shall be told the following:
(1) Contents to be released;
(2) That the information is needed to verify eligibility;
(3) That the client can give or withhold the consent and the consent is voluntary; and
(4) That there are statutes, rules, and regulations protecting the confidentiality of the information.
History Note: Authority G.S. 108A-54; 108A-54.1B; 108A-80; 42 C.F.R. 431.304; 42 C.F.R. 431.306;
Eff. September 1, 1984;
Amended Eff. August 1, 1990;
Transferred from 10A NCAC 21A .0410 Eff. May 1, 2012;
Readopted Eff. June 1, 2019.
10A NCAC 23H .0111 DISCLOSURE WITHOUT CLIENT CONSENT
(a) Client information from the Medicaid record may be disclosed without the consent of the client under the following circumstances:
(1) To other employees of the county department of social services for purpose of making referrals, supervision, consultation, or determination of eligibility;
(2) To other county departments of social services when the client moves to that county and requests Medicaid;
(3) Between the county departments of social services and the Division of Health Benefits for purposes of supervision and reporting.
(1) An explanation of how the findings of the study are expected to expand knowledge and improve professional practices among those who work in the field studied;
(2) A description of how the study will be conducted and how the findings will be used;
(3) The individual's credentials in the area of investigation;
(4) A description of how the individual will safeguard the information; and
(5) An assurance that no report will contain the names of individuals or other information that makes individuals identifiable.
(c) Client information may be disclosed without consent to federal, State , or county employees for the purpose of monitoring, auditing, evaluating, or to facilitate the administration of other State and federal programs, provided that the need for the disclosure of confidential information is justifiable for the purpose and that adequate safeguards, as described in 42 C.F.R. 431.300, which is incorporated by reference with subsequent amendments and editions and available free of charge at https://www.ecfr.gov/, are maintained to protect the information from re-disclosure.
(d) Client information may be disclosed without consent for purposes of complying with other State and federal statutes, rules, and regulations and court orders.
(e) When information is released without the client's consent, the client shall be informed of the disclosure in writing to explain what information was released, how it was released, and how to contact the privacy official. The writing informing the client of the disclosure shall be documented in the record.
History Note: Authority G.S. 108A-54; 108A-54.1B; 108A-80; 42 C.F.R. 431.306;
Eff. September 1, 1984;
Transferred from 10A NCAC 21A .0411 Eff. May 1, 2012;
Readopted Eff. June 1, 2019.
10A NCAC 23H .0112 DOCUMENTATION OF CONSENT OR DISCLOSURE
Whenever client information is disclosed in accordance with rules of this Subchapter, the director or delegated representative shall document the disclosure in the client record.
History Note: Authority G.S. 108A-54; 108A-54.1B; 108A-80;
Eff. September 1, 1984;
Transferred from 10A NCAC 21A .0412 Eff. May 1, 2012;
Readopted Eff. June 1, 2019.
10A NCAC 23H .0113 PERSONS DESIGNATED TO DISCLOSE INFORMATION
Only directors of county departments of social services and their designated representatives may disclose client information in accordance with rules of this Subchapter. The process for delegation is set out in G.S. 108A-14(b).
History Note: Authority G.S. 108A-54; 108A-54.1B; 108A-14(b); 108A-80;
Eff. September 1, 1984;
Amended Eff. August 1, 1990;
Transferred from 10A NCAC 21A .0413 Eff. May 1, 2012;
Readopted Eff. June 1, 2019.
10A NCAC 25H .0205 RESTRICTIONS AND PRIOR APPROVAL
(a) The Division of Health Benefits shall have the right of prior approval for dental services except for routine and emergency services.
(b) All other dental services are subject to prior approval. Dental services categories requiring dental prior approval are as follows: Elective root canal treatment, periodontal services, orthodontic services, complex oral surgical and reconstructive procedures, complete and partial dentures, denture relines and analgesia (nitrous oxide). Each specific procedure under the American Dental Association (ADA) service category in this Paragraph will be listed in the provider dental manual and provider bulletins with the appropriate prior approval service restriction guidelines.
(c) The Division of Health Benefits may require prior approval for any services for individual providers who have been investigated by the Division under 10A NCAC 22F or by the Attorney General's Fraud Control Unit under 42 Code of Federal Regulations 455.300, and the investigation resulted in monetary recovery of payments made by Medicaid to the provider or criminal conviction of the provider.
History Note: Authority G.S. 108A-25(b); 108A-54; S.L. 1985, c. 479, s. 86;
Eff. February 1, 1976;
Amended Eff. September 30, 1977;
Readopted Eff. October 31, 1977;
Amended Eff. October 1, 1992; February 29, 1980;
Transferred from 10A NCAC 22O .0205 Eff. May 1, 2012;
Pursuant to G.S. 150B-21.3A, rule is necessary without substantive public interest Eff. July 23, 2016;
Amended Eff. March 1, 2020.